security #token :  Refine the use of the synchronizer token to protect a user session when using functions on the credential management. In this case, the user isn't nessecary authentified and the web page needs to be protected against some attack technics like the fuzzing. So, in order to use the synchronizer token to protect the web pages on the credential management, a token is created automatically at each session opening by the web container (so the synchronizer token can be used with anonymous navigation). (This token is then renewed once the user is authentified.) Some administration functions are again vulnerable to CSRF and XSS attacks because of the use of a cookie to carry the synchronizer token (the use of a such cookie is mandatory currently in Silverpeas because of the deep use of frames and of multi-relocation requesting), so it was necessary to explicitly protect these functions and thus to break regrettably the centralization and the generalization of the token management code. The anonymous access was also tested and some bugs fixed